Computers in an organization are often linked together to form a private network so that the computers can communicate with each other and share resources. Such an internal computer network within the control of an organization is commonly referred to as an “intranet.” Many intranets are composed of local area networks, although the intranets of some large organizations have grown very large and require the level of sophistication found in the Internet.
Today's network environment demands secure data communications. A major concern for private networks is the possibility of security breach through communications with external networks. As the Internet and the World Wide Web become the essential backbone for worldwide commerce and information sharing, the need for manageable and secure networks becomes more urgent than ever. A fundamental key to the implementation of a secure network is the ability to manage network access. To protect the integrity and vital data of an intranet, a network administrator has to be able to implement policies to restrict access to certain users or sources. The restrictions may be based on various parameters, such as user credentials, the source address, the destination address, time of the day, etc. To that end, a policy agent standing between a private network and an external network, such as the Internet, is typically the focal point for carrying out the network access policies. A policy agent may be, for example, a network firewall that guards the intranet and hides its structure from the outside by filtering communication packets or performing session-based application-level access control.
A successful implementation of access control often requires the capability of applying access policies based on user credentials, i.e., who the user is, whom the user is allowed to send or receive network communication to or from, etc. The commonly used network protocols, however, typically do not lend themselves to user authentication in connection with network access. Network communication data are represented in a variety of network protocols. Each of the existing network protocols serves one or more technical purposes within a network environment. Typically, under those protocols, only the source and destination addresses and ports are provided in the header of the network data, and the access policies are typically limited to those parameters. The lack of user information in the communication packets makes it very difficult to implement network policies based on user credentials. It is possible, of course, to create a new network protocol that includes information for user authentication in the data stream. Such a solution, however, may not be preferred, as it will require almost all existing network applications to be rewritten to accommodate the new protocol.